yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] brett19:
I assume that file is what handles decoding the SIN file we upload and sending out the parts for it to process. Doesn't seem like there is any code in there that does anything, it simply calls the function (sec_s1_compute_SHA1) that generates the SHA1 hash so they can verify the Signature.

Cheers, Brett

Edit: I'm at work right now, I'll take a better look at it when I'm home tonight.

Edit: After some further analysis, that binary seems to be a test they have to ensure the integrity of the SHA1 algorithm, It would be quite bad if they messed something up with the hashing and made it so even THEY weren't able to flash new firmwares ;)
[XPERIA X10 Android Development] maxrfon:
New achievement!

Now i can access nand (FINALLY)! I get the flash ID 10/10 times, so it works stady.

Next step is to find a way to read nand by pages and find where the SBL (S1 Second Boot Loader) resides and swap it with the one we have.

Let's go.
[XPERIA X10 Android Development] maxrfon:
I need a hand of a nand expert.

PM me pls.

EDIT: Thanks for the congrats but it's not the time. Please do not post here anything but tech related info.

Because my request posts get lost amond the other messages.

Thanks guys!
[XPERIA X10 Android Development] :
Universal SIN2IMG

i have made System SIN 2 IMG Converter

so if you could test it on few different images thank you...

Here it is...

http://dl.dropbox.com/u/10158456/SIN2IMG.rar
[XPERIA X10 Android Development] :
Seems to be working well. Nice work!

zephyrix: thanks for testing it..

Works fine (under WINE), good job!
[XPERIA X10 Android Development] zephyrix:
You need to stop all services and umount everything first.

That being said.. I've only gotten frozen while trying to load a new kernel.
[XPERIA X10 Android Development] Nikhil_007:
@cocker80...Hi, im not a devloper, but ill try to answer ur question. Ist of all pls try to post ques on another thread like there is a thread for non devlopers in android dev section, or u can try Q&A section.

To start up with ur ans, we r not tryin to load another rom aftr booting SE one, as bootloader checks for signed rom which is encrypted & no one can break 1024b encryption right now, so our approach is to replace the bootloader itself (residing in nand chip) with our dev one, so it doesnt check any signature on rom and v can load any rom of our choice. As of for progress, v have reachd a point where v can communicate with nand chip. So v just need to crack where the bootloader resides & change it with dev one. Hope u c the change in approach:-) mods can u pl move these querries in q&a section?

X10i Android 2.1 + JIT...
[XPERIA X10 Android Development] Nikhil_007:
Nand write

Hi Maxfron,

Sorry to catch up late on cracking this SE **** (couldn't really give much time owing to busy Office routine)

Well i was trying to catch up with previous progress on this thread...to be frank, i guess you have already done most of hard work here...congrats man..

well i have some knowledge regarding intracting with nand or nor chips in low level...did it few yrs ago during my study assignments..

about writing nand, i dont know which chip sony x10 uses so cant help abt specific details till i know the architecture of same..

but to illustrate, i did dig out a code for reading a samsung nand chip from one of forums, im enclosing here, hoping it could b of some reference. let me know further.

#include<INIT_REG.H>

#define FLASH_MD1 0xeff0 //chip enable nand flash 1

#define FLASH_MD2 0xfff0 //chip enable nand flash 2

#define FLASH_MA1 0xeff2 //enable address nand flash 1

#define FLASH_MA2 0xfff2 //enable address flash 2

#define FLASH_MC1 0xeff1 //enable command nand flash 1

#define FLASH_MC2 0xfff1 //enable command nand flash 2

#define read_id 0x90

void read_flash_id(void);

void page_write_flash(unsigned char addrlow,addrmid,addrhigh);

void read_flash(unsigned char addrlow,addrmid,addrhigh);

void delay();

void flash_reset();

void main(void)

{

unsigned char i=0,j=0;

init_snd1();

flash_reset();

read_flash_id();

page_write_flash(0x0,0x0,0x0);

read_flash(0x0,0x0,0x0);

while(1);

}

void flash_reset()

{

unsigned char xdata *xaddress;

xaddress=FLASH_MC1;

*xaddress=0xff;

delay();

}

void read_flash_id(void) // ´®¿ÚÊä³öIDÂë

{

unsigned char xdata *xaddress;

unsigned char x,y;

xaddress=FLASH_MC1;

*xaddress=read_id;

xaddress=FLASH_MA1;

*xaddress=0x00;

xaddress=FLASH_MD1;

x=*xaddress;

printf(x);

y=*xaddress;

printf(y);

}

void page_write_flash(unsigned char addrlow,addrmid,addrhigh)

{

unsigned char xdata *buff;

unsigned char temp;

unsigned int i;

//erase flash block

buff=FLASH_MC1;

*buff=0x60;

buff=FLASH_MA1;

*buff=addrmid;

*buff=addrhigh;

buff=FLASH_MC1;

*buff=0xd0;

delay();

do{

buff=FLASH_MC1;

*buff=0x70;

buff=FLASH_MD1;

temp=*buff;

printf(temp);

temp=temp&0x01;

}

while(temp!=0x00);

//while(1);

//erase sucessfull

//write one page data

buff=FLASH_MC1;

*buff=0x80;

buff=FLASH_MA1;

*buff=addrlow;

*buff=addrmid;

*buff=addrhigh;

buff=FLASH_MD1;

for(i=0;i<512;i++)

{

*buff=i;

printf(i);

}

buff=FLASH_MC1;

*buff=0x10;

delay();

do{

buff=FLASH_MC1;

*buff=0x70;

buff=FLASH_MD1;

temp=*buff;

printf(temp);

temp=temp&0x41;

}

while(temp!=0x40);

}

void read_flash(unsigned char addrlow,addrmid,addrhigh)

{

unsigned char xdata *source;

unsigned int i,temp;

source=FLASH_MC1;

*source=0x00;

source=FLASH_MA1;

*source=addrlow;

*source=addrmid;

*source=addrhigh;

delay();

do{

source=FLASH_MC1;

*source=0x70;

source=FLASH_MD1;

temp=*source;

printf(temp);

temp=temp&0x40;

}

while(temp!=0x40);

source=FLASH_MD1;

i=512;

while((i--)>0)

{

temp=*source;

printf(temp);

}

}

void delay()

{

unsigned int temp;

for (temp=0; temp<3000;temp++) ;

}
[XPERIA X10 Android Development] maxrfon:
Hi!

It's ok, better later than never ;)

So the idea is ok, understood. Thank you very much.

Please check the Micron 8Gbit flash. There is only one.

/* Flash ID ID Mask Density(MB) Wid Pgsz Blksz oobsz onenand Manuf */
{0x55d1b32c, 0xFFFFFFFF, (1024<<20), 1, 2048, (2048<<6), 64, 0}, /*micron*/

So the complete commands and addresses you can find in the nand.h

The read ID command is not 0x90 anymore, it was in the old nand, and maybe it is still so but not in the case.

Those new ones have special register to read the ID.

So i will appreciate any help on it.

Thanks in advance.

Max
[XPERIA X10 Android Development] maxrfon:
Pardon my dust, the source code you put is for samsung's onenand btw.
[XPERIA X10 Android Development] Nikhil_007:
Ya, Its for samsung, but it shld give good understandng to build a similar..wot do u think..? Btw is it dat, u just need to read nand to get address 4 sbl if im not wrong..lemme know, ill try to modify more 4 x10..

EDIT Btw, I think biktor has worked a lot with Jtag v can just confirm 4m him if he has got his hand on nand thing too.. May b he can b our saviour here. Who knows..lol..;-) Wot do u reckon..?

X10i Android 2.1 + JIT...
[XPERIA X10 Android Development] brett19:
Hey guys,

I forgot to ask, is DMA completely blocking our ability to access NAND directly? Or would there be a way to bypass if we found it (like, found where the NAND was actually located in memory).

Cheers, Brett
[XPERIA X10 Android Development] maxrfon:
Nothing is blocked, all works fine, but we need to build a function to read page in raw mode.

This is the task, nothing else we need right now.

And since we can get flash ID using DMA - we are in already.

There are enough examples in the nand.c but their function does not work in some reason.

Maybe wdog.. bcause we jump into the boot from the OS and all the settings and tasks are still alive. So maybe there is something to reset the tasks. It's all ARM stuff, who knows how ARM CPU works can do it easy.
[XPERIA X10 Android Development] maxrfon:
JTAG is blocked...
[XPERIA X10 Android Development] maxrfon:
From nand read page:

data->cfg0 = CFG0;

data->cfg1 = CFG1;

The both CFG should be initialized during the boot startup, flash_init() does it. But in our case, since we jump into "hot" system, we can't get it, it does an error.

See attachment:
[XPERIA X10 Android Development] brett19:
Does anyone have a link to those files that I can get to just over HTTP? I am at work and cannot remote home to take a look at my local files right now as I'm taking calls.

Thanks, Brett

Edit: If not I'll drop it on my local server on my lunch.
[XPERIA X10 Android Development] maxrfon:
What files do you mean?
[XPERIA X10 Android Development] brett19:
Hey, I meant the usbloader files :) Don't worry about it though, I'll drop it on my local server, I'm having lots of time between calls today so I thought I would keep myself occupied trying to figure out the NAND crap.

Cheers, Brett
[XPERIA X10 Android Development] Umeaboy:
I'm sorry if I get offtopic now, but does THIS help you to get past the problem? http://xdaforums.com/showthread.php?t=732160
[XPERIA X10 Android Development] maxrfon:
Hi Nikhil_007!

I just finished my custom software to communicate with the bootloader (usbloader) from windows. So i will check your code today, but i am sure the flash is just locked at the runtime as it could be easily locked for particular sectors access while the system is running. Unless you have got something already as the output?

We do not have to hurry up now, let's read the raw data first.

What does Goroh mean using the ECC abracadabra i have no idea, i believe flash, being controlled, can accept to write whatever you want and we want to write our own sbl.

And basically read means read just raw data and see what is inside...

Then all the other tasks will get queued, right? Why do we need now to write since we can't even read properly ? :)
[XPERIA X10 Android Development] falcon_88:
Can anyone gimme the datasheet for the nand chip being used and QSD8250.
[XPERIA X10 Android Development] Nikhil_007:
Hi by above post i meant....

mtd: nand: make reads using MTD_OOB_RAW affect only ECC validation

current "raw" routinesuse a traditional layout

This changes the behavier of MTD_OOB_RAW. It used to read both OOB and

data to the data buffer, however you would still need to specify the

dummy oob buffer.

This code removes that behavier, and fixed the user.

Now MTD_OOB_RAW behaves just like MTD_OOB_PLACE, but doesn't do ECC

validation

The above code basically work as if in Raw mode..

if u go thru the links in last u ill understand wot i mean. and it helps us to do oth READ/WRITE Nand therefore should in theory solve our purpose..

lemme know any updates...

EDIT: Just an info about wot ECC Does..

http://www.eetindia.co.in/ART_8800548077_1800009_AN_62759ed8.HTM

So no abracadabra anymore..lol... :)
[XPERIA X10 Android Development] maxrfon:
Thank you for such a good research, but as i am not an expert of nand tech this means lamost nothing for me.

We have the code, it's in the mtd sources, so why this code does not work in our usbloader - this is the question.

In Theory i understand something that should be done, but i would love to see it in code, then i will understand completely what to do.

Did you manage to run this code and you have any result?

Thanks a lot, please keep on! We have not so many good experts in nand :)

!

Max
[XPERIA X10 Android Development] Nikhil_007:
Check ur pm..

X10i Android 2.1 + JIT...
[XPERIA X10 Android Development] Nikhil_007:
Hi Max,

Check ur PM..

Edit: I need kernal sources for 2.1, r they out??
[XPERIA X10 Android Development] maxrfon:
Hi, i work with 1.6, so if you have 2.1 phone it will not work.

And btw would be nice to get the new sources too.
[XPERIA X10 Android Development] Nikhil_007:
Ya, thought so, anyways thanks for d mail, have a busy week ahead but ill definately take some time out nailing this *****...:)

BTW, i was looking at nand write & i guess we can tweak it a bit just substituting the read function instead of write. I ill give it a shot. my problem is even if i get free time in office, my laptop runs XP & there is no way i can compile using GNU tool on same or is there a way?? coz that ill be very helpfull, cant install ubuntu on office laptop due to security checks implemented in office environment..:(
[XPERIA X10 Android Development] maxrfon:
Hi

Look, you can only compile it in Linux.. So it would be nice for you to boot from USB with Ubuntu. It's easy, just google USB Ubuntu..
[XPERIA X10 Android Development] argnom:
Coule also use a virtual machine. If you can install vmware player, you should be good to go.
[XPERIA X10 Android Development] falcon_88:
@max

dude can u just gimme the exact code by which u get flash id.i have looked thoroughly into nand data sheets by Micron.If i can draw an analogy i will be able to pin it down.
[XPERIA X10 Android Development] maxrfon:
Yeah, PM your email.
[XPERIA X10 Android Development] Bin4ry:
Sorry hooking in.

Anyone else noticed this line in kernel-ramdisk /init.rc ?

service flash_recovery /system/etc/install-recovery.sh
oneshot

Haven't found this "install-recovery.sh" till now, but for me it sounds interesting, because it must be able to access the recovery partition, maybe SE has made all the work for us?

So is anyone able to access the partition where kernel is flashed to? I have tryed the more_mtd but no luck till now!

Regards

Bin4ry
[XPERIA X10 Android Development] mayank.1love:
/system/etc/install-recovery.sh script helps in booting back to stock mobile recovery in case we have modified the recovery partition in our mobile.

This is just a counter measure from android to stop us from using a new recovery image. If we remove the script we can boot into our custom recovery without any problem.

http://xdaforums.com/showthread.php?t=611829&page=101

The problem is that do we have a custom recovery image for our X10?

If yes then we can flash the recovery partition using

flash_image recovery /sdcard/recovery-image.img
or
fastboot erase recovery
fastboot flash recovery cm-recovery-1.4.img

But I also found that flash_image or fastboot is also not present in bin folder, that means we can only do the steps from fastboot from our computer.

http://xdaforums.com/showthread.php?t=567943

I also got a flashboot for windows if that can help

http://android-roms.googlecode.com/files/fastboot-win32.zip

For the original question install-recovery.sh is just a countermeasure to stop us from using custom recovery.

I have also attached a install-recovery.sh I got from net so that you can have a look at it.
[XPERIA X10 Android Development] zephyrix:
You can't get into fastboot though.

At least that was the case when we were on 1.6. Maybe that has changed.
[XPERIA X10 Android Development] zephyrix:
Hello,

I extracted ramdisk from firmware files.. found some executables in /sbin which do not show up in the actual system. Please take a look:

http://dl.dropbox.com/u/47919/Android/sbin.rar

edit: fs-update is our fota flash application, just like the first 1.6 root!

It shows the fota updating image when I run it. Perhaps we can make use of this.

++

http://android.cablekevin.nl/index.php?title=FOTA_Root
[XPERIA X10 Android Development] zdzihu:
flash_image won't work since we don't have recovery partition visible. Loader hasn't changed since 1.6 so no fastboot either.

Btw the script you provided is not real install-recovery.sh :) It's some custom file they made for Motorola
[XPERIA X10 Android Development] mayank.1love:
Yup thats true that flash_image will not work in our situation, it only works in dev bootloader or unlocked bootloader. Fastboot also works when the bootloader is unlocked. I can't get any real SE install-recovery.sh may be because SE never uses it.

The current best way is just booting our custom/vanilla os over default locked bootloader until we find a foolproof way to unlock the bootloader.
[XPERIA X10 Android Development] MoridinBG:
I have a development Mini Pro (the ones with the famous 0044 IMEI) that I used to test 2.1 for several months before release. Can this be of any help (without sending it or bricking it, of course)?

As well as limited EMMA access (to most of the current and testting firmwares).
[XPERIA X10 Android Development] vegard_e:
What is the output of cat /proc/mtd ?
[XPERIA X10 Android Development] MoridinBG:
mtd0 cache

mtd1 appslog

mtd2 userdata

mtd3 system

Nothing special. It's flashed with release firmware, that lacks some testing stuff that was present on the test firmware.
[XPERIA X10 Android Development] 28spawn:
Some parts of SE kernel if it can help you to analyze the bootloader and system :D

Just things edited by them.

Good luck and gogo custom rom !

http://hotfile.com/dl/83728042/743d8d5/kernel.zip.html

http://hotfile.com/dl/83821188/29c71ab/TouchscreenDriver.zip.html
[XPERIA X10 Android Development] Nikhil_007:
Hi anyone...Pl...need a arm toolchain to work with GCC 4.4.5 working on Cygwin ( as my office environment has loadz of restriction for running linux)would have made my own, but have busy week so little help ill be appreciated...i have a concept need to test, i modified the code in Nand a bit and i think i should be able to access nand in burst mode..
[XPERIA X10 Android Development] maxrfon:
Best is : send me the code i will check it in 10 minutes.

If you can't run linux you can't use cygwin.
[XPERIA X10 Android Development] maxrfon:
Compile fastboot

Guys, can anyone help to complie fastboot in windows? (For windows of course).

?
[XPERIA X10 Android Development] zephyrix:
http://dl.dropbox.com/u/47919/Android/fastboot.exe
[XPERIA X10 Android Development] maxrfon:
Thanks, but i mean COMPILE from sources ;)

Not a binary.
[XPERIA X10 Android Development] j4mm3r:
MinGW

It looks like you will have to use MinGW, check the Android.mk in the fastboot folder in the source tree, you will see what I mean.
[XPERIA X10 Android Development] Danieltam:
can u sent a copy to me？i can't access dropbox website……:(

my mail：tanxu0307@hotmail.com ，thx alot
[XPERIA X10 Android Development] maxrfon:
Today had an idea but can't test it.

Does anyone know how to create recovery.img from a binary file?

Not real recovery i mean, but my binary into recovery.
[XPERIA X10 Android Development] aget1:
you mean packing a img file?

http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images
[XPERIA X10 Android Development] zdzihu:
PM me if you still need help

Cheers,

zdz
[XPERIA X10 Android Development] maxrfon:
No, i mean how to make a header that would let flash_image to flash my own recovery.img (which is not a recovery actualy, but my own code).
[XPERIA X10 Android Development] maxrfon:
Ok tested, does not work.. Sin header is flashed together with code, so if even i flash my own code it won't start :(

Digging further...
[XPERIA X10 Android Development] :
Q: About SE BootLoader...

i have x10mini btw..

i have take a look in sin / kernel etc files...

and as far as i can see... bootloader is hard coded to seach for SIN part of img

in SIN is stored SIN version, flash imei, model info, memory size, system image offset etc..

it uses byte swap, shift etc to readout info...

kernel is well.. to complex...

if i'm wrong correct me..
[XPERIA X10 Android Development] maxrfon:
"Sin" is just a header that contains signature of the code, following the header. Nothing else.

It's normal RSA with preambule of a bunch of SHA things.

IMEI is in OTP - so called one Time Programmed mem.

SE was always the a most hard to crack one. All HTCs and other androids are like nuts, cracked one by one. SE is a real hard nut.

I almost managed to do it, thanks to Goroh Kun. His idea to reset the modem to free the nand works.(although it's not his idea :) but HTC's rtask a one's) But his realisation allows to talk to nand, therefore it shifts me closer to the solution.

I had a break to hack HTC, just to see how the things are in android, because HTC is the most easy to hack thinga. I got some ideas and i will try to implement it next week.

PS mini or not - rules the same: SE
[XPERIA X10 Android Development] :
PEM File Viewer...

Yet another tool...

Quick PEM file viewer and result dumper...

for now only opens Test x509 pem from SE image dump..

i guess for every tool there is usefullness, right?

here link:

http://dl.dropbox.com/u/10158456/PEMInfo.rar
[XPERIA X10 Android Development] pulpoff2:
Hi guys,

can someone update me on what happen to kexec attempts?

I remember seeing goroh's posts about being able to almost start his own kernel, right ?

I believe thats the best way we have for now .. so where did it stop ?
[XPERIA X10 Android Development] zdzihu:
http://xdaforums.com/showpost.php?p=7519189&postcount=154
[XPERIA X10 Android Development] maxrfon:
Guys i got a weird problem with MTD reading using CAT /dev/mtd/mtdx.

When i read a page i miss some bytes, like 4 per page. That is to say after every 512 bytes i get something looking like checksum, but the whole page of 0x800 bytes miss the end. Next page starts normal, but the story repeats with it too. Looks like this kind of checksum is placed instead of real data.

Any help?

The code is msm_nand.c - nothing special..
[XPERIA X10 Android Development] Umeaboy:
Does reading http://xdaforums.com/showthread.php?t=843403 help you?

I'd also read this: http://android.git.kernel.org/?p=ke...ff;h=f417104baf49849553ad3235ffb9e6f0e8d60feb
[XPERIA X10 Android Development] maxrfon:
Nothing out of all that helps. The problem is not in code, the nand reading goes well, but every 512bytes (0x200) i have either ECC or something like that at the end of 0x200 bytes block, and the whole page misses 16 bytes.

That's what i mean. Just i found somehting, but if not to read/write it properly the phone will die :)
[XPERIA X10 Android Development] zdzihu:
Hi Max, those 16 bytes are OOB area, in my understanding it should be irrelevant for your task (since it's only used as spare place/marking bad blocks).

Cheers,

zdz
[XPERIA X10 Android Development] maxrfon:
Yeah, in raw mode all the data was ok.

Thanks. But in normal - not. Definitely page size was wrong for reading!

Anyway, fixed, continuing.
[XPERIA X10 Android Development] Meikrekel:
You've probably seen this already, but in case you missed it: http://xdaforums.com/showthread.php?t=857142

where on post number #29 he says:
[XPERIA X10 Android Development] tidy:
Can someone please P/M me the pin outs for jtag?
[XPERIA X10 Android Development] maxrfon:
Hi 2all

I noticed here someone used kexec to add mtd partitions. Can you explain how to?

Thanks
[XPERIA X10 Android Development] maxrfon:
Anyone?

The question above..
[XPERIA X10 Android Development] zdzihu:
Do you mean via kernel command line?

Cheers,

zdzihu
[XPERIA X10 Android Development] Nikhil_007:
We need full nand map to do that..

I m not sure, if its possible rite now, we need full NAND access (nanad map), we must dump a whole NAND and find there a partiton table.then find a find a XIP start address.

we need this to map nand for this command from cmdline.

how far we have access to nand that depends how far max has gone...???

as far if im not wrong above quote means, 4.4Mb @0x3fbc0000 for appslog...and so on..
[XPERIA X10 Android Development] :
Q: about this engineering key..

few posts before someone post this >> X10_Donut_100721_01 archive there was engineering key type of p12... i have found password..

converted into normal pem file but it seems that it doesn't have nothing in there...

but hey maybe someone find something i haven't...

here is link to files: http://dl.dropbox.com/u/10158456/X10_Donut_100721_01.rar
[XPERIA X10 Android Development] Nankov:
Everything is here i really hope it helps that is some good info.

http://www.youtube.com/watch?v=GPjd6gHY6A4
[XPERIA X10 Android Development] hagisbasheruk:
I am presuming that is some engineering SBL ?

Would be help to get this SBL and any info regarding it to me @ gmail

Well it looks like reverse engineering this is not needed just an easy method to Flash.
[XPERIA X10 Android Development] zdzihu:
Please PM Maxrfon

Cheers,

z